Method and apparatus for managing electronic money and storage for storing an electronic money management program

ABSTRACT

According to the present invention, when electronic money is sent from a given network to another network, a money change apparatus performs a money change process to change electronic money current on the given network into electronic money current on another network, and therefore when a user of the given network uses a settling process, by managing this money change process, it is possible to manage the interchange of electronic money between each of the users of the given network and each of the users of another network without affecting the working environment of electronic commerce. Electronic money current on LAN 20  is referred to as local electronic money current only on the network. When a terminal NLU 4  connected to LAN 20  sends money to a terminal NWU 2  connected to WAN 10 , GW 1  for controlling the flow of data between LAN 20  and WAN 10  receives local electronic money sent from the terminal NLU 4 , changes the local electronic money into electronic money current on WAN 10 , then sends the electronic money to the terminal NWU 2 , and when a terminal NWU 2  sends money to a terminal NLU 4 , GW 1  receives electronic money sent from the terminal NWU 2 , changes the electronic money into local electronic money and sends the local electronic money to the terminal NLU 4.

BACKGROUND OF THE INVENTION

1. Field of the Invention

The present invention relates to technology for managing electronicmoney that circulates on networks, such as the Internet.

2. Description of Related Art

Electronic commerce (EC) on networks such as the Internet is nowspreading widely. Under the circumstances, technology has been proposedfor settling accounts in electronic commerce on a network. Thistechnology is called electronic settlement. Some systems and protocolsproposed so far are listed in the following.

(1) First Virtual

An electronic settlement system proposed by First Virtual. Credit cardsettlement is used. It is a precondition that only digital informationgoods transferable on a network are dealt with. Electronic mail is usedto give and accept orders, but facsimile is used to transmit cardnumbers for security reasons.

(2) CyberCash

An electronic settlement system proposed by CyberCash. Credit cardsettlement is used. In addition to giving and accepting orders, networkssuch as the Internet are used to transmit information about card numbersor the like, which need to be safeguarded. Therefore, a powerfulencryption process is performed on those items of information beforetransmission to ensure security.

(3) SET (Secure Electronic Transaction)

This is an electronic settlement protocol, proposed by VisaInternational, Master Card International, etc. Credit card settlement isused. As in CyberCash, a strong encryption process is conducted oninformation about giving and accepting orders and card numbers or thelike before transmission.

Furthermore, SET provides means for authenticating credit card users andmeans for authenticating member stores where the credit cards can beused.

(4) Ecash

Ecash is an electronic settlement system proposed by DigiCash and usesthe electronic money digital cash system. More specifically, cashsettlement is made by electronic money having a value equal to an actualpaper currency. The user draws electronic money corresponding to the sumof payment from the storage medium, and sends the money to therecipient.

The above examples (1) to (3) are applications of settlement by creditcard to settlement in electronic commerce. Therefore, credit cards arerequired to settle accounts. Information about a card number or thelike, which needs to be protected, must be sent in one form or another.Moreover, the flow of money (who spent how much, and where) is known toa third party, in other words, it shows low anonymity.

In contrast to these, ecash in (4) applies cash settlement by bills andcoins for settlement in electronic commerce. Unlike (1) to (3) above,credit cards are not required. Like in cash settlement by bills orcoins, it is difficult for a third party to detect the flow of money(strong anonymity).

As has been described, ecash is highly convenient because it does notuse credit cards as a means of settlement. Technology, like ecash, whichrealizes settlement on a network by electronic money, is generallycalled network type electronic money. Unless otherwise defined, thenetwork type electronic money is hereafter referred to simply aselectronic money.

SUMMARY OF THE INVENTION

As described in RELATED ART above, there are a variety of kinds ofelectronic money. It can easily be foreseen that many other kinds ofelectronic money will appear and circulate intermingling on the networksin the future. At present, however, electronic commerce is impossiblebetween the users of different kinds of electronic money, a fact whichgreatly reduces the effectiveness of electronic settlement.

With the progress of electronic money, it will become possible forindividual persons to easily remit large sums of money across theboundaries of countries. Under such a situation, there are possibilitiesfor the management of currency transfer from one country to another toget out of control, which easily gives rise to financial insecurity,such as inflation or deflation on an international scale.

As described above, electronic money is characterized by its strongprotection of anonymity of the user. However, in the case of theconventional ecash described above, when members of organizations, suchas business firms, use electronic money, owing to its characteristic, itis anticipated that problems will arise which would not be sotroublesome when individual persons use electronic money. To cite someexamples,

(1) When a member of an organization settles an account with a useroutside the organization by using electronic money, the administrativedepartment (e.g., the accounting or materials department) of theorganization is unable to manage the settlement of the account.

(2) Since it becomes possible to send remittance outside theorganization easily by the use of electronic money, the amount of damagemay run up to an alarming sum in the case of a remittance error,embezzlement or fraud.

With the conventional form of ecash, if a payment is made by electronicmoney on hand, a sum of payment is collected as a combination ofdifferent nominal values of electronic money and the money is sent. Forthis reason, the user must always be cognizant of the numbers ofdifferent pieces of electronic money of different nominal values that hepossesses.

The present invention has been made with the above problems taken intoconsideration, and has its object to enable management of the transferof electronic money without affecting the working environment ofelectronic commerce when settlement systems for different kinds ofelectronic money are used.

To solve the above problems, the present invention provides a method ofmanaging electronic money in a network apparatus installed between afirst network and a second network, wherein electronic money circulatingonly within the first network is designated as electronic money currenton the first network (This electronic money is hereafter referred to aselectronic money A), the method comprising the steps of:

when a first terminal connected to the first network sends money to asecond terminal connected to the second network, receiving electronicmoney A sent from the first terminal, changing the electronic money Ainto electronic money current on the second network (The latterelectronic money is hereafter referred to as electronic money B), andsending electronic money B to said second terminal; and

when the second terminal sends money to the first terminal, receivingelectronic money B sent from the second terminal, changing theelectronic money B into electronic money A, and sending electronic moneyA to the first terminal.

In the above case, the network apparatus is a gateway or a router, forexample.

In the present invention, electronic money that can be handled by thefirst terminal connected to a certain network is assumed to beelectronic money A current in that network, in other words, electronicmoney A is assumed to be a different kind of electronic money fromelectronic money B current on another network. According to the presentinvention, a network apparatus connected both to one network and anothernetwork is charged with performing a money change function betweenelectronic money A and electronic money B. By this arrangement, themoney change process is always performed by the network apparatus duringthe settlement process when electronic commerce is performed between thefirst and the second terminals.

Therefore, according to the present invention, when a user of the firstterminal connected to a certain network conducts electronic commercewith a user of the second terminal connected to the other network, thenetwork apparatus invariably performs the money change process betweenelectronic money A and electronic money B to settle accounts.Accordingly, the organization (the administrative department, namely,the accounting or materials department) that manages the users connectedto that certain network can manage the settlement of accounts betweenthe user at the first terminal connected to the certain network and theuser at the second terminal connected to the other network by, forexample, recording a history of the money change process at the networkapparatus and monitoring the records. As a result, it is possible tominimize trouble in electronic commerce, such as errors in remittance orembezzlement.

Local electronic money can be transferred directly between the users ofthe terminals connected to a certain network without intervention of thenetwork apparatus, so that anonymity as the advantage in payment byelectronic money can be maintained.

In the present invention, when the first terminal sends money to thesecond terminal, if the nominal value of electronic money A sent fromthe first terminal is larger than the amount of money previouslyallotted to the user at the first terminal, the money change process maybe designed such that electronic money A is sent back to the firstterminal without being converted into electronic money B.

By this arrangement, in electronic commerce between the user at thefirst terminal connected to the certain network and the user at thesecond terminal connected to the other network, trouble in electroniccommerce, such as an error in remittance or embezzlement, can be furtherminimized efficiently.

Further, in the present invention, the network apparatus may be soarranged as to change electronic money A sent from the first terminalinto a desired combination of different nominal values of electronicmoney A in response to a command from the first terminal.

In this case, the user at the first terminal can get a desired amount ofelectronic money A generated even if he is not aware of the quantitiesof different nominal values of electronic money A that he possesses.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic configuration diagram of a network apparatus towhich an embodiment of the present invention is applied;

FIG. 2 is a schematic block diagram showing the function realized by aCPU executing an electronic money management program in an informationprocessing apparatus having a communication function using a network;

FIG. 3 is a diagram showing log files generated by a log recorder 117;

FIG. 4 is a diagram showing an example of the content of each log filein FIG. 3; FIG. 4A shows an example of an electronic money receipt log1171; FIG. 4B shows an example of a local electronic moneygeneration/sending log 1172; FIG. 4C shows an example of a localelectronic money collection/deletion log 1173; and FIG. 4D shows anexample of an electronic money payment log 1174;

FIG. 5 is an example of a format of electronic money issued by terminalNB3;

FIG. 6 is an example of a format of electronic money a generated by alocal electronic money generator 113 in FIG. 2;

FIG. 7 is a flowchart for explaining the operation of remittance fromterminal NWU2 to terminal NLU4;

FIG. 8 is a flowchart for explaining the operation of remittance fromterminal NLU4 to terminal NWU2;

FIG. 9 is a diagram showing an example of local electronic money in FIG.6 added with a user's digital signature;

FIG. 10 is a flowchart for explaining the operation f remittance fromterminal NLU4 a to terminal NWU4 b;

FIG. 11 is a flowchart for explaining the operation f remittance fromterminal NLU4 a to terminal NLU4 b in a first modification of theembodiment;

FIG. 12 is a diagram showing an example of a message sent from terminalNLU4 on the sender side to terminal GW1 in the first modification of theembodiment of the present invention;

FIG. 13 is a diagram showing local electronic money paid into a moneybox1151 of the remittance destination as directed by the message shown inFIG. 12;

FIG. 14 is a diagram showing an example of the content stored in apermission file 1152;

FIG. 15 is a flowchart for explaining the operation for the user at theterminal NLU4 a to obtain authority from the user at the terminal NLU4 bin a second modification of the embodiment of the present invention;

FIG. 16 is a diagram showing an example of local electronic moneyaccompanied by a message asking for authority to remit in the secondmodification of the embodiment of the present invention; and

FIG. 17 is a diagram showing an example of local electronic moneyaccompanied by an authority transfer message in the second modificationof the embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

A preferred embodiment of the present invention will be described in thefollowing.

FIG. 1 is a schematic configuration diagram of the network apparatus towhich a preferred embodiment of the present invention is applied.

WAN10 denotes a Wide Area Network, LAN20 denotes a Local Area Network,and GW1 denotes a gateway located between WAN10 and LAN20. NB's 3 a, 3 bare terminals of a bank issuing electronic money, and are connected toWAN10 (hereafter NB's 3 a, 3 b are referred to merely as NB3). NMU's 2a, 2 b and NLU's 4 a, 4 b are terminals of the users of an accountssettling system by electronic money. NWU's 2 a, 2 b (hereafter referredto also as NWU2) are connected to WAN10, while NLU's 4 a, 4 b (hereafterreferred to also as NLU4) are connected to LAN20. In this embodiment,terminals NLU4 connected to LAN20 are assumed to be terminals used byusers of an organization (a business firm, for example), and terminalsNWU2 connected to WAN10 are assumed to be terminals used by usersoutside the organization. In other words, LAN20 is formed within anorganization.

In this embodiment, electronic money that can be handled by theterminals NLU4 connected to LAN20 is limited to electronic money that iscurrent only within LAN20, namely, a kind of electronic money that isdifferent from electronic money issued by the terminal NB3 (hereafterelectronic money current only within LAN20 is referred to as localelectronic money, while electronic money issued by the terminal NB3 isreferred to simply as electronic money.) In this embodiment, GW1 ischarged with performing a money change function between electronic moneyand local electronic money.

Under this arrangement, in an electronic transaction conducted betweenthe terminals NLU4 a and NLU4 b connected to LAN20, payment is madedirectly by local electronic money. Furthermore, in an electronictransaction between a terminal NLU4 connected to LAN20 and a terminalNWU2 connected to WAN10, a money change process is invariably carriedout at GW1.

More specifically, when money is remitted from a terminal NLU4 to aterminal NWU2, GW1 intercepts local electronic money sent from theterminal NLU4, changes the local electronic money into the correspondingamount of electronic money, and sends it to the terminal NWU2. On theother hand, when a terminal NWU2 remits money to a terminal NLU4, GW1intercepts electronic money sent from the terminal NWU2 and changes theelectronic money into the corresponding amount of local electronicmoney. GW1 then sends the local electronic money to the terminal NLU4.

Therefore, in this embodiment, when a member of an organization conductselectronic commerce with a user outside the organization, a money changeprocess is always performed at GW1 between electronic money and localelectronic money. For this reason, the administrative department(accounting or materials) of the organization can manage the settlingprocess between a member of the organization and a user outside theorganization by monitoring the money change process at GW1. Because ofthis, it is possible to minimize damage caused by remittance errors,embezzlement, or the like.

Local electronic money can be transferred directly between the membersof the organization without intervention by GW1, so that anonymity asthe advantage in settling accounts by electronic money can bemaintained.

A detailed description will now be given of the components of thenetwork apparatus to which this preferred embodiment is applied.

The terminals NB3 of the bank that issues electronic money will first bediscussed. It is assumed that a user at a terminal NWU2 has had anaccount opened and an organization in which LAN20 has been establishedhas had its account opened at this bank.

Each of the terminals NB3 withdraws cash from the customer's account andchanges cash into electronic money, or changes electronic money intocash and deposits cash in the customer's account.

More specifically, in response to a command sent from the terminal NWU2through WAN10, the terminal NB3 withdraws cash from the account of theuser at the terminal NWU2, changes cash into electronic money, and sendselectronic money through WAN10 to the terminal NWU2. Also, the terminalNB3 changes electronic money sent through WAN10 from the terminal NWU2into cash, and deposits cash into the account of the user at theterminal NWU2.

Similarly, in response to a command sent through WAN10 from GW1, NB3withdraws cash from the account of the organization in which LAN20 isset up, changes cash into electronic money, and sends it through WAN10to GW1. Furthermore, NB3 changes electronic money remitted through WAN10from GW1 into cash, and deposits it into the account of the organizationhaving LAN20 formed therein.

In addition, the terminal NB3 performs a certification process forelectronic money sent and an authentication process on electronic moneyreceived.

The terminal NB3 is basically the same as a terminal of a bank used forthe electronic money digital cash system including ecash that has beendescribed in the RELATED ART above. The terminal NB3 can be realized bya CPU executing a program loaded in memory from a recording medium, suchas a magnetic disk in an information processing apparatus including afunction of transferring electronic money on a network.

Description will next be given of the terminal NWU2 operated by a usernot belonging to the organization including LAN20.

The NWU2 calls on a terminal NB3 to withdraw cash from a designatedaccount and change it into electronic money, or sends electronic moneyto the terminal NB3, and directs it to change to cash and deposit thecash into a designated account.

The terminal NWU2 is basically the same as a user's terminal which isused for utilizing the electronic money digital cash system, such asecash described in the RELATED ART above. The terminal NWU2 can berealized by a CPU executing a predetermined program loaded in memoryfrom a recording medium, such as a magnetic disk, in an informationprocessing apparatus including a function of transferring electronicmoney on a network.

Description will next be given of the terminal NLU4 used by a member ofan organization incorporating LAN20.

The NLU4 is basically the same as the terminal NWU2. It should be notedthat electronic money that can be handled by the terminal NWU2 iselectronic money issued by the terminal NB3, while electronic money thatcan be handled by the NWU2 is local electronic money current only withinLAN20.

As mentioned earlier, GW1 performs a money change process between localelectronic money and electronic money, for which reason the terminalNLU4 can execute settlement processes with the other parties toelectronic commerce without worrying about whether the other party is ata terminal of LAN20 or WAN10.

Description will now be given of GW1 which performs the money changeprocess between local electronic money and electronic money.

GW1 has a function of controlling data transmitted between WAN10 andLAN20. This function is realized by a transport programs TP12 a and 12 bloaded into memory by CPU from a recording medium, such as a magneticdisk, in an information processing apparatus incorporating a function ofcommunication on a network as shown in FIG. 1. The TP12 a relays dataand messages exchanged with the terminals of WAN10 to a specifiedprogram (EMMP11, for example, which will be described later). On theother hand, TP12B relays data and messages exchanged with the terminalsof LAN20 to a specified program (EMMP11, described later). Thesefunctions are the same as those in an ordinary gateway.

In addition to these functions, GW1 in this embodiment further includesa function of controlling electronic money held by the organizationusing LAN20 (including the money change process between local electronicmoney and electronic money). This function is realized by a CPUexecuting an electronic money management program EMMP11 loaded intomemory from a recording medium, such as a magnetic disk, in aninformation processing apparatus having a function of communication on anetwork as illustrated in FIG. 1.

FIG. 2 is a schematic block diagram showing the functions realized by aCPU executing the electronic money management program EMMP11 in aninformation processing apparatus having a function of communication on anetwork.

An electronic money content analyzer 112 analyzes electronic moneyreceived from a terminal NWU2, and sends the money to a terminal NB3.The content analyzer 112 requests the terminal NB3 to change theelectronic money into cash and deposit the cash in the account. Thecontent analyzer 112 passes information obtained by analysis of theelectronic money from the terminal NWU2 to a local electronic moneygenerator 113. According to information from a local electronic moneyeraser 114, the content analyzer 112 requests the terminal NB3 towithdraw an amount of cash specified by the information from the accountand change it into electronic money. The content analyzer 112 receiveselectronic money from the terminal NB3, and sends it to the terminalNWU2.

On the basis of information from the electronic money content analyzer112, the local electronic money generator 113 generates an amount oflocal electronic money corresponding to electronic money received fromthe terminal NWU2.

A local electronic money content analyzer 115 contains a moneybox 1151for accommodating local electronic money held by a member of theorganization having LAN20, and a permission file 1152 includinginformation, such as the amount of local electronic money that themember can handle.

The local electronic money content analyzer 115 stores local electronicmoney generated by the local electronic money generator 113 in amoneybox 1151 corresponding to the user of a terminal NLU4 being areceiver (a member of the organization having LAN20), and also sends anotification of this to the terminal of the receiver. Furthermore, thelocal electronic money content analyzer 115 analyzes local electronicmoney received from the terminal NLU4 by referring to the permissionfile 1152 and log recorder 117, and sends analysis information to alocal electronic money eraser 114.

The local electronic money eraser 114, on the basis of information fromthe local electronic money content analyzer 115, erases local electronicmoney corresponding to an amount, specified by the information, from themoneybox 1151 specified by the information, and sends a notification ofthis to the electronic money content analyzer 112.

The log recorder 117 records the processes of the components shown inFIG. 2.

FIG. 3 is a diagram showing log files generated by the log recorder 117.

In FIG. 3, an electronic money receipt log 1171 contains records on theprocess of remittance of electronic money from a terminal NWU2 connectedto WAN10 to a terminal NB3 and the process of money conversion to cash.A local electronic money generation and transfer log 1172 containsrecords on the generation and transfer processes of local electronicmoney. A local electronic money collection and erase log 1173 holdsrecords on the collection and erasure processes of local electronicmoney. An electronic money payment log 1174 stores records on theremittance process of electronic money.

Those log files are described in the following.

FIG. 4A shows an example in the electronic money receipt log 1171.

In FIG. 4A, in the acceptance number field, the acceptance number ofelectronic money received at the electronic money content analyzer 112is written in the order of acceptance. The processing date and timefield indicates the date and time of acceptance of electronic money atthe electronic money content analyzer 112. The sender field indicatesdata including the address of the user at the terminal (NWU2 a or 2 b)which remitted electronic money. The receiver field shows data includingthe address of the user at the terminal (NLU4 a or 4 b) as thedestination of electronic money. The money-received field indicates thenominal value of electronic money. The bank name field indicates datasuch as the address of the bank office (NB3 a or 3 b) where electronicmoney was cashed. The authentication result field shows informationabout whether or not electronic money was successfully cashed.

FIG. 4B shows an example in the local electronic money generation andtransfer log 1172.

In FIG. 4B, the acceptance number field indicates the acceptance numberof local electronic money generated by the local electronic moneygenerator 113 and the receipt of local electronic money is written inthe order of generation. The index number field shows the acceptancenumber at the electronic money receipt log 1171 of electronic money,which was converted into local electronic money. The processing date andtime field indicates the dates and times of generation of localelectronic money. The sender field indicates the address of the user atthe terminal (NWU2 a or 2 b) that remitted the electronic moneyconverted to local electronic money. The money receiver field shows dataincluding the address of the user at the receiving terminal (NLU4 a or 4b) of local electronic money. The money-received field indicates thenominal value of local electronic money. The server name field indicatesthe name of the gateway (GW1 in this embodiment) which generated localelectronic money. The remittance result fields indicate informationabout whether local electronic money was remitted to the receiversuccessfully or not.

FIG. 4C shows an example in the local electronic money collection anderase log 1173.

In FIG. 4C, in the acceptance number field, the acceptance number oflocal electronic money erased by the local electronic money eraser 114is written in the order of erasure. The index field indicates theacceptance number at the local electronic money generation and transferlog 1172, of erased local electronic money. The processing date and timefield indicates the date and time of erasure of local electronic money.The sender field indicates data including the address of the user at theterminal (NLU4 a or 4 b) that remitted local electronic money. Thereceiver field indicates data such as the address of the user at theterminal (NWU2 a or 2 b) as the destination of electronic moneyconverted from local electronic money. The money-received fieldindicates the nominal value of the erased local electronic money. In theserver name field, the name of the gateway (GW1 in this embodiment)which erased local electronic money is written. In the erasure resultfield, information about whether or not the local electronic money waserased successfully is written.

FIG. 4D shows an example in the electronic money payment log 1174.

In FIG. 4D, in the acceptance number field, the acceptance number ofelectronic money sent by the electronic money content analyzer 112 iswritten in the order of remittance. The index number field indicates theacceptance number, at the local electronic money collection and erasurelog 1173, of local electronic money converted to electronic money. Theprocessing date and time field shows the date and time of remittance ofelectronic money. The sender field indicates information including theaddress of the user of the terminal (NLU4 a or 4 b) as the source ofremittance of local electronic money converted to electronic money iswritten. The receiver field indicates information such as an address ofthe user of the terminal (NWU2 a or 2 b) being the remittancedestination of the local electronic money converted into electronicmoney. The money received field shows the nominal value of localelectronic money converted into electronic money. The bank name fieldindicates information including the address of the bank office (NB3 a or3 b) that issued the electronic money. The remittance result fieldindicates information about whether the electronic money was remittedsuccessfully or not.

Description will now move on to electronic money issued by the terminalNB3. This electronic money is basically the same as that used in theelectronic money digital cash system, such as ecash described in theRELATED ART above.

FIG. 5 shows an example of the format of electronic money issued at theterminal NB3.

In the Value field, the value of electronic money is written. In theSerial field, the serial number by which the bank manages the issuanceof electronic money is written. In the Generator field, the address ofthe bank office that generated electronic money is written. TheSignature field indicates a digital signature which was obtained byencrypting the contents of the above-mentioned fields using a secret keythat the bank possesses. This digital signature certifies that the bankshown in the Generator field generated electronic money.

Description will now proceed to local electronic money current only inLAN20.

FIG. 6 shows an example of the format of local electronic moneygenerated by the local electronic money generator 113 shown in FIG. 2.

The Value field indicates the value of electronic money converted tolocal electronic money. In the Serial field, the serial number of thislocal electronic money is written. This serial number indicates thenumber in the order of generation at GW1 and the same number is not usedagain. Written in the From field is data including the address of theuser at the terminal (NWU2 a or 2 b) as the source of remittance ofelectronic money converted into the local electronic money. In the Tofield, data including the address of the user at the receiving terminal(NLU4 a or 4 b) of local electronic money is written. The Generatorfield indicates data including the address of the gateway (GW1 in thisembodiment) that issues local electronic money. The Signature fieldindicates a digital signature which was obtained by encrypting theabove-mentioned content of the fields with a secret key possessed by thebank.

Description will next be given of the operation of the network apparatusto which this embodiment is applied.

In this embodiment, to avoid wiretapping on the network, all data ormessages, including electronic money, are subject to encryptionprocessing using the public-key encryption system before they aretransmitted on the network. A digital signature obtained by encryptingthe data or message with the secret key of the user at the sendingterminal is added to each data or message.

Description will now continue with the operation of making remittancefrom a terminal NWU2 connected to WAN10 to a terminal NLU4 connectedLAN20.

FIG. 7 is a flowchart for explaining the operation of making remittancefrom a terminal NWU2 to a terminal NLU4.

A user at a terminal NWU2 sends a connection request message to aterminal NB3 of the bank where his own account has been opened. Onreceiving the connection request message, the terminal NB3 sends aconnection-acknowledging message to the terminal NWU2. Thus, aconnection is established between the terminal NWU2 and the terminalNB3.

Subsequently, the terminal NWU2 performs a process by a specificfunction using the amount of money to remit to a terminal NLU4 and arandom number it generates as arguments to thereby generate a string ofdigits. A message requesting the issuance of electronic money has agenerated digit string (blind signature) appended and is sent to theterminal NB3 (Step 2001).

When receiving this message, the terminal NB3 withdraws the amountrequested from the account of the user at the terminal NWU2, changes themoney into electronic money as shown in FIG. 5, and after encryption,sends an encrypted electronic money to the terminal NWU2 (Step 1001).Then, NWU2 releases the connection with the terminal NB3.

The terminal NWU2, when receiving electronic money from the terminalNB3, sends a connection request message to the terminal NLU4 as thereceiver of remittance (Step 2002). This connection request message isreceived by GW1 before reaching the terminal NLU4. In response to themessage, the GW1 performs a money receiving procedure on behalf of theterminal NLU4.

GW1 passes the connection request message through TP12 a to theelectronic money content analyzer 112 of EMMP11. Accordingly, theelectronic money content analyzer 112 sends a connection-acknowledgingmessage accompanied by a public key of GW1 to TP12 a. TP12 a sends thismessage received from the content analyzer 112 to the terminal NWU2 thatsent the connection request (Step 3001). Thus, a connection isestablished between GW1 and the terminal NWU2.

The terminal NWU2, when receiving the connection-acknowledging message,encrypts electronic money, which is to be remitted, using a public keyattached to the connection-acknowledging message, and sends encryptedelectronic money to the terminal NLU4 as the destination of remittance(Step 2003). The encrypted electronic money is received by GW1 beforereaching the terminal NLU4, and changed by GW1 to local electronicmoney. Local electronic money is transmitted to the terminal NLU4 as thedestination of remittance.

GW1 passes encrypted electronic money through TP12 a to the electronicmoney content analyzer 112 of EMMP11.

The electronic money content analyzer 112 decrypts encrypted electronicmoney using its own secret key, and checks the name of the bank thatissued the electronic money from decrypted electronic money. Then, theelectronic money content analyzer 112 sends a connection request messageto TP12 a. TP12 a sends the message received from the electronic moneycontent analyzer 112 to the terminal NB3 of the bank revealed at theelectronic money content analyzer 112 (Step 3002).

When receiving the connection request message, the terminal NB3 sends aconnection-acknowledge message along with its own public key to GW1 thatsent the connection request message(Step 1002). Consequently, aconnection is established between the terminal NB3 and GW1.

GW1 sends the connection-acknowledge message from the terminal NB3through TP12 a to the electronic money content analyzer 112 of EMMP11.The electronic money content analyzer 112 encrypts electronic moneyreceived from the terminal NWU2 using a public key attached to theconnection-acknowledging message, and sends the encrypted electronicmoney to TP12 a. TP12 a sends encrypted electronic money received fromthe electronic money content analyzer 112 to the terminal NB3 (Step3003).

When receiving the encrypted electronic money, the terminal NB3 decryptsthe electronic money using its own secret key, and makes a judgmentwhether or not to approve the receipt of the electronic money bychecking the serial number and the digital signature of decryptedelectronic money (Step 1003). When receipt is rejected as a result ofjudgement, NB3 sends a rejection message to GW1. After this, NB3releases the connection with GW1.

GW1 sends a receipt rejection message, which has come from NB3, throughTP12 a to the electronic money content analyzer 112 of EMMP11. Inresponse, the electronic money content analyzer 112 sends a transactionfailure message to TP12 a. TP12 a sends the transaction failure messagetransmitted from the electronic money content analyzer 112 to theterminal NWU2 that sent the electronic money (Step 3004). Subsequently,GW1 releases the connection with the terminal NWU2.

The terminal NWU2 terminates the process after receiving a transactionfailure message (Step 2004).

On the other hand, when it approves the receipt of remittance as aresult of judgement, the terminal NB3 changes electronic money, receivedfrom GW1, to cash and deposits the cash into the account of theorganization to which the user at the terminal NLU4 belongs. Then, NB3sends a receipt success message to GW1 (Step 1004). After this, theterminal NB3 terminates the process by releasing the connection with GW1(Step 1005).

When receiving the receipt success message from the terminal NB3, GW1sends this message through TP12 a to the electronic money contentanalyzer 112 of EMMP11. In response to this, the electronic moneycontent analyzer 112 sends a transaction success message to TP12 a. TP12a sends the transaction success message, received from the electronicmoney content analyzer 112, to the terminal NWU2 that sent theelectronic money. The connection established between the terminal NWU2and GW1 is then released.

The log recorder 117 writes electronic money receipt information in theelectronic money receipt log 1171 (Step 3005). As shown in FIG. 4A, theacceptance number, processing date and time, sender, receiver, moneyreceived, bank name, and receipt success/failure message are written inthe related fields.

The terminal NWU2 terminates the process after receiving the transactionsuccess message (Step 2005).

After the process at Step 3005 is closed, the electronic money contentanalyzer 112 of GW1 notifies the acceptance number, recorded by the logrecorder 117 in the electronic money receipt log 1171, to the localelectronic money generator 113. In response to this, the localelectronic money generator 113, searches the electronic money receiptlog 1171 by using the acceptance number received from the electronicmoney content analyzer 112, and reads received money informationcorresponding to the acceptance number. The local electronic moneygenerator 113 generates an amount of local electronic moneycorresponding to the amount of money received. The log recorder 117writes information about generation and transfer of local electronicmoney in the local electronic money generation and transfer log 1172(Step 3006). As shown in FIG. 4B, in the field of acceptance number, thenumber in the order of processing is written. In the field of processingdate and time, the date and time when the information is written isindicated. In the fields of sender, receiver and money received,information in the electronic money receipt log 1171 is copied. In thefield of money change server, the name of GW1 is written. At this pointin time, no information is written in the field of remittance result.

The local electronic money generator 113 of GW1 sends generated localelectronic money along with information written in the local electronicmoney generation and transfer log 1172 to the local electronic moneycontent analyzer 115. In response to this, the local electronic moneycontent analyzer 115 stores local electronic money in a moneybox 1151 ofthe receiver determined by the supplied information. Then, a messageindicating the arrival of local electronic money is sent through TP12 bto the terminal NLU4 of the receiver (Step 3007). Subsequently, GW1releases the connection with the terminal NLU4.

Next, the log recorder 117 writes a remittance result in the field ofremittance result in the local electronic money generation and transferlog 1171. GW1 terminates the process (Step 3008).

The user (a member of the organization) at the terminal NLU4 thatreceived the message, if he wants to use local electronic money,establishes a connection with GW1, and sends his own public key to GW1(Step 4001). GW1 passes the public key through TP12 b to the localelectronic money content analyzer 115. The local electronic moneycontent analyzer 115 withdraws local electronic money from the moneybox1151 of the user at the terminal NLU4 who sent the public key, andencrypts local electronic money with the public key, and sends the moneyto the terminal NLU4 (Step 3009).

The terminal NLU4 receives the encrypted local electronic money (Step4002), and stores it in a suitable recording device. The user can usethe encrypted local electronic money by decrypting it with his ownsecret key.

Description will be given of the operation of making remittance from aterminal NLU4 connected to LAN20 to a terminal NWU2 connected to WAN10.

FIG. 8 is a flowchart for explaining the operation of sending money froma terminal NLU4 to a terminal NWU2.

In a terminal NLU4, after encrypted local electronic money stored in therecording device is decrypted using the user's own secret key, the localelectronic money has a digital signature appended using this secret key(Step 4101). Incidentally, an example of local electronic money shown inFIG. 6 having a user's digital signature attached is shown in FIG. 9.

The terminal NLU4 sends a connection request message to a terminal NWU2as the destination of remittance (Step 4102). This connection requestmessage is received by GW1 before reaching the terminal NWU2. Inresponse to the connection request message, GW1 performs a remittanceprocedure on behalf of the terminal NLU4.

GW1 passes the connection request message through TP12 b to the localelectronic money content analyzer 115 of EMMP11. In response to this,the local electronic money content analyzer 115 sends aconnection-acknowledge message accompanied by GW1's public key to TP12b. TP12 b sends the message conveyed by the local electronic moneycontent analyzer 115 to the terminal NLU4 that sent the connectionrequest message (Step 3101). Consequently, a connection is establishedbetween GW1 and the terminal NLU4.

When receiving the connection-acknowledge message, the terminal NLU4encrypts local electronic money, which is to be remitted, with a publickey attached to the connection-acknowledge message, and sends theencrypted local electronic money to the terminal NWU2 as the destinationof remittance (Step 4103). The encrypted local electronic money isreceived by GW1 before reaching the terminal NWU2, and is converted intoelectronic money.

This electronic money is sent to the terminal NWU2 as the destination.

GW1 sends encrypted local electronic money through TP12 b to theelectronic money content analyzer 115 of EMMP11. In response thereto,the local electronic money content analyzer 115 decrypts the encryptedlocal electronic money using its own secret key. GW1 checks the digitalsignature attached to decrypted local electronic money against apreviously registered public key of a user (a user using a digitalsignature) at the-terminal NLU4 (Step 3102).

If the public key which is required for checking a digital signature hasnot been registered, GW1 gets the public key transmitted by sending amessage requesting the transmission of the public key to the terminalNLU4 of the user who added the digital signature.

As a result of the check, if abnormality is discovered in the digitalsignature (Step 3103), the local electronic money content analyzer 115stores the local electronic money in a moneybox exclusively for abnormallocal electronic money, installed inside the moneybox 1151. After this,GW1 sends a transaction termination message to TP12 b. TP12 b passes thereceived transaction termination message to the terminal NLU4 thattransmitted the local electronic money. An alarm is issued to notify themanager at GW1 of the detection of abnormality in the digital signature(Step 3104). Then, GW1 releases the connection with the terminal NLU4(Step 3105).

When receiving the transaction termination message, the terminal NLU4terminates the process (Step 4104).

On the other hand, as a result of the check, if abnormality is not foundin the digital signature (Step 3103), the local electronic money contentanalyzer 115 searches the local electronic money generation and transferlog 1172 of the log recorder 117 to obtain a log with the acceptancenumber that coincides with the serial number of the local electronicmoney.

If the search ended in failure, or though the search was successful, ifthere is a possibility that the local electronic money is a counterfeitas a result of comparison of the data on the local electronic money withthe data on the log, it follows that local electronic money not undercontrol of GW1 is circulating. Therefore, the above-described processesat Steps 3104 and 3105 are executed.

If the search is successful and if there is no possibility ofcounterfeit of the local electronic money according to the result ofcomparison between data on the local electronic money and data on thelog, the local electronic money content analyzer 115 sends the localelectronic money to the local electronic money eraser 114.

In response, the local electronic money eraser 114 passes the acceptancenumber of the local electronic money to the electronic money contentanalyzer 112 and also passes data and the acceptance number of the localelectronic money to the log recorder 117.

The log recorder 117 writes information about local electronic money,received from the local electronic money eraser 114, in the localelectronic money collection and erasure log 1173 (Step 3106). As shownin FIG. 4C, the number in the order of processing is written in thefield of acceptance number. The serial number (equal to the acceptancenumber of the local electronic money generation and transfer log 1172)is written in the field of index number. The date and time of entry ofthis information is written in the field of processing date and time.The sender, the receiver and the nominal value of local electronic moneyare written in the fields of sender, receiver and money received,respectively. At this point in time, no information is written in thefields of money change server and erasure result.

The electronic money content analyzer 112 reads information from thelocal electronic money collection and erasure log 1173, the informationcorresponding to the acceptance number received from the localelectronic money eraser 114. Next, the electronic money content analyzer112 returns the read out information and the acceptance number to thelog recorder 117. In response, the log recorder 117 writes theinformation about local electronic money, received from the electronicmoney content analyzer 112, to the electronic money payment log 1174(Step 3106). As shown in FIG. 4D, the number in the order of processingis written in the field of acceptance number. The serial number of localelectronic money (equal to the acceptance number at the local electronicmoney collection and erasure log 1173) is written in the field of indexnumber. The date and time of entry of this information is written in thefield of processing date and time. The sender, the receiver and thenominal value of electronic money are written in the fields of thesender, receiver and money received, respectively. At this point intime, no information is written in the fields of bank name andremittance result.

Then, the electronic money content analyzer 112 sends a connectionrequest message to TP12 a. TP12 a passes the received connection requestmessage to a terminal NB3 of a bank where an account of the organizationto which the user at the terminal NLU4 belongs has been opened. Whenreceiving the connection request message, the terminal NB3 sends aconnection-acknowledging message to the source of the connection requestmessage. Thus, a connection is established between GW1 and the terminalNB3.

The electronic money content analyzer 112 performs a process with aspecific function using the amount of money to remit (the nominal valueof local electronic money written on the electronic money payment log1174) and a random number it generates as arguments to thereby generatea string of digits. The electronic money content analyzer 112 sends amessage requesting the transmission of electronic money added with theabove-mentioned string of digits (a blind signature) to the terminal NB3(Step 3107).

When receiving this message to transmit electronic money, the terminalNB3 withdraws the requested amount of money from the account of the userof GW1, that is, the organization in which LAN20 is formed, and afterconverting the money into electronic money as shown in FIG. 5, NB3encrypts electronic money and sends it to GW1 (Step 1101).

GW1, on receiving electronic money from the terminal NB3, sends aconnection request message to the terminal NWU2 being the destination ofremittance (Step 3109).

The terminal NWU2, on receiving a connection request message, sends aconnection-acknowledging message with an accompanying public key to GW1that gave NWU2 the connection request message (Step 2101). Thus, aconnection is established between GW1 and the terminal NWU2.

GW1, on receiving the connection-acknowledging message, encrypts aremittance amount of electronic money using the public key that camewith the connection-acknowledging message, and sends encryptedelectronic money to the terminal NWU2 being the destination ofremittance (Step 3110).

The terminal NWU2, on receiving encrypted electronic money, decrypts theelectronic money using its own secret key to thereby find a bank namethat issued the electronic money from the decrypted electronic money.Then, NWU2 sends a connection request message to a terminal NB3 of thatbank.

The terminal NB3, on receiving the connection request message, sends aconnection-acknowledging message with its own public key to the terminalNWU2 that sent the connection request message. As a result, a connectionis established between the terminal NWU2 and the terminal NB3.

The terminal NWU2 encrypts electronic money received from GW1 with apublic key that came with the connection-acknowledging message, andsends the encrypted electronic money to the terminal NB3 (Step 2102).

The terminal NB3, on receiving the encrypted electronic money, decryptsthe electronic money using its own secret key. The terminal NB3 checksthe serial number and a digital signature on the decrypted electronicmoney and thereby judges whether or not to approve the receipt of theelectronic money (Step 1102). As a result of the check, if it rejectsthe receipt of electronic money, NB3 sends a reject message to theterminal NWU2. Subsequently, NB3 releases the connection with NWU2.

In response to this, the terminal NWU2 sends a transaction failuremessage to GW1 (Step 2103), and then terminates the process.

GW1 passes the transaction failure message, received from the terminalNWU2, through TP12 a to the electronic money content analyzer 112. Inresponse to this, the electronic money content analyzer 112 sends thisinformation to the log recorder 117 and the local electronic moneycontent analyzer 115. The log recorder 117 writes “FAILURE” in the fieldof the remittance result of the electronic money payment log 1174 andthe fields of erasure result of the local electronic money collectionand erasure log 1173 (Steps 3111 and 3112). The local electronic moneycontent analyzer 115 returns local electronic money corresponding to theamount of electronic money involved in the transaction failure to themoneybox 1151 for the terminal NLU4 of the money sender. GW1 sends themoney sender at the terminal NLU4 a message indicating that the localelectronic money has been returned (Step 3112). GW1 then terminates theprocess by releasing the connection with the terminal NLU4 (Step 3113).

The terminal NLU4 terminates the process, when it receives the messageindicating that the local electronic money has been returned (Step4105).

If the terminal NB3 permits the receipt of the electronic money as aresult of the check, it changes the electronic money received from theterminal NWU2 into cash, has the cash deposited in the account of theuser using the terminal NWU2, and sends a receipt success message to theterminal NWU2. Then, NB3 terminates the process by releasing theconnection with the terminal NWU2 (Step 1103).

In response to this, the terminal NWU2 sends a transaction successmessage to GW1, and terminates the process by releasing the connectionwith GW1 (Step 2104).

When receiving the transaction success message from the terminal NWU2,GW1 passes this message, sent from the terminal NWU2 through TP12 a, tothe electronic money content analyzer 112. In response to this, theelectronic money content analyzer 112 passes this information to the logrecorder 117. The log recorder 117 writes “SUCCESS” in the remittanceresult field of the electronic money payment log 1174 and also in theerasure result field of the local electronic money collection anderasure log 1173 (Steps 3114 and 3115). Then, GW1 terminates the processby releasing the connection with the terminal NLU4 (Step 3116).

Description will be given of the operation in a transaction betweenterminals NLU4 connected to LAN20.

FIG. 10 is a flowchart for explaining the operation of remittance from aterminal NLU4 a to a terminal NLU4 b.

The terminal NLU4 a sends a connection request message to the terminalNLU4 b being the destination of remittance (Step 4201).

The terminal NLU4 b, when receiving the connection request message,sends a connection-acknowledging message with its own public key to theterminal NLU4 a that gave NLU4 b the connection request message (Step4301). Thus, a connection is established between the terminals NLU4 aand NLU4 b.

Next the terminal NLU4 a, using its own secret key, decrypts theencrypted local electronic money which has been stored in a storagedevice, and adds a digital signature to the local electronic money byusing the secret key (Step 4202). Then, the terminal NLU4 a encrypts thelocal electronic money using a public key received from the terminalNLU4 b, and sends the encrypted local electronic money to the terminalNLU4 b (Step 4203). After this, NLU4 a releases the connection with theterminal NLU4 b.

The terminal NLU4 b receives the encrypted local electronic money (Step4302), and stores it in a suitable storage device. The user can use theencrypted local electronic money by decrypting it using its own secretkey.

A preferred embodiment of the present invention has been described.

As described above, in this embodiment, electronic money that can behandled by the terminals NLU4 connected to LAN20 is limited to a kind ofelectronic money current only in LAN20. More specifically, theelectronic money is limited to local electronic money, a different kindof electronic money from electronic money issued by terminals NB3.

When a terminal NLU4 connected to LAN20 conducts electronic commercewith a terminal NWU2 connected to WAN10, a money change process at GW1is invariably involved in the settlement of accounts. In addition, thecontents of the process are recorded in a log.

In other words, in the present embodiment, when a member of anorganization having LAN20 formed therein conducts electronic commercewith a user outside the organization, a money change process at GW1between electronic money and local electronic money is always carriedout in the settlement of accounts, and the process is recorded in a log.Therefore, the administrative department (accounting or materialsdepartment, for example) can manage the account settlement between amember of the organization and a user outside the organization bymonitoring the log in which the details of the process at GW1 arerecorded. Accordingly, it is possible to minimize damage resulting froman error in remittance or embezzlement.

Local electronic money can be interchanged directly between the membersof an organization without intervention of GW1, in which case anonymityas the advantage in settlement by electronic money can be maintained.

In the embodiment mentioned above, description has been given of theelectronic money digital cash system on the assumption of the use ofecash that adopts blind signature that provides electronic money withsuperlative anonymity (Scientific American, August 1992, pp. 96-101).However, the present invention is not limited to this electronic money,but may be applied to various electronic money digital cash systems.

In the present embodiment, discussion has been devoted to the electronicmoney management apparatus which has a gateway adapted to perform amoney change function and is located between LAN20 and WAN10. However,the present invention is not limited to this arrangement, but theapparatus (a network apparatus, such as a gateway or a router), whichcan intercept electronic money flowing from one network to another,should be provided with a money change function.

Furthermore, in the present embodiment, description has been given ofthe electronic money management system wherein in the interchange oflocal electronic money, local electronic money can be transferreddirectly between the terminals NLU4 a and NLU4 b connected to LAN20without using an intervening GW1. However, the present invention is notlimited to this type, but the intervening GW1 may be employed.

Description will now be given of a first modification of the presentembodiment, in which an intervening GW1 is used in the interchange oflocal electronic money between the terminals NLU4 a and NLU4 b.

In this first modification, GW1 is charged with not only withvicariously executing money remittance but also changing received localelectronic money for local electronic money of proper nominal values andmaking remittance.

FIG. 11 is a flowchart for explaining the operation of remittance fromthe terminal NLU4 a to the terminal NLU4 b in the first modification ofthe present embodiment.

The terminal NLU4 a retrieves a plurality of local electronic moneystored in a storage device, creates a message including the localelectronic money added with a script of the contents of a request to GW1and a digital signature, and sends the message to GW1 (Step 4401).

FIG. 12 shows an example of a message to be sent by the terminal NLU4 onthe sender side to GW1 in the first modification of the presentembodiment.

In FIG. 12, reference numerals 701 to 703 denote a plurality of localelectronic money retrieved from the storage device. FIG. 12 shows thesame format (but in a simple form) for these electronic money as in FIG.6. Reference numeral 704 denotes a script and a digital signature addedto local electronic money 701 to 703.

In FIG. 12, the contents of the script are as follows.

@ sum (256, 303, 386)

Sum up local electronic money of serial numbers 256, 303 and 386.

@ div (¥1,000,000: user1)

Send ¥1,000,000 to the user at the terminal NLU4 b.

@ bal (:ME):

Return the balance to the source of remittance.

The digital signature at the end of the message is formed by encryptionof the message from its head portion till the end of the script using asecret key of the user at the terminal NLU4 a as the source ofremittance.

When receiving the message from the terminal NLU4 a, GW1 passes themessage through TP12 b to the local electronic money content analyzer115. In response to this, the local electronic money content analyzer115 checks the digital signature attached at the end of the message(Step 3201).

If abnormality is found by checking the digital signature, GW1 performsan abnormal termination routine to close the process (Step 3202). On theother hand, when abnormality is not found, the local electronic moneycontent analyzer 115 checks the digital signature on each piece of localelectronic money (reference numerals 701 to 703 in FIG. 12) included inthe message received (Step 3203).

If abnormality is found as a result of the check, an abnormaltermination routine is performed to terminate the process (Step 3202).On the other hand, if no abnormality is found, the local electronicmoney content analyzer 115 searches the local electronic moneygeneration and transfer log 1172 to retrieve a log with an acceptancenumber coincident with the serial number of each piece of localelectronic money included in the message received. Then, the moneycontent analyzer 115 checks for double use or the like of localelectronic money from data on the log retrieved (Step 3204).

If abnormality is found by the check, GW1 performs an abnormaltermination routine to close the process (Step 3202). If no abnormalityis found, the local electronic money content analyzer 115 transfers thelocal electronic money received and its acceptance number to the localelectronic money eraser 114. The log recorder 117 writes informationregarding each local electronic money included in the message receivedby the local electronic money content analyzer 115 in the localelectronic money collection and erasure log 1173 (Step 3205). At thispoint, no data is written in the fields of the money change server andthe erasure result in the local electronic money collection and erasurelog 1173. In addition, the local electronic money is not erased.

On receiving local electronic money and its acceptance number from themoney content analyzer 115, the local electronic money eraser 114 sendsa request to the local electronic money generator 113 to generate localelectronic money. The request includes information about the receiver,sender, money received, and a script shown in FIG. 12.

The local electronic money generator 113 generates local electronicmoney according to the request from the local electronic money eraser114 (specifically, the contents of the script in FIG. 12), addsinformation about destinations specified by the request (¥1,000,000 tothe terminal NLU4 b; ¥208,000 to be returned to the terminal NLU4 a inthe example in FIG. 12) to the local electronic money, and sends thelocal electronic money to the local electronic money content analyzer115. The log recorder 117 records information required for generationand management of local electronic money to the local electronic moneygeneration and transfer log 1172. Subsequently, the local electronicmoney generator 113 sends a message to the local electronic money eraser114.

The local electronic money eraser 114 erases the local electronic moneysent from the terminal NLU4 a of the sender. The log recorder 117 writesinformation in the empty fields, that is, in the money change serverfield and the erasure result field in the local electronic moneycollection and erasure log 1173.

Subsequently, the local electronic money content analyzer 115 stores thelocal electronic money received from the local electronic moneygenerator 113 into the moneybox 1151 of the user specified by thedestinations information added to the local electronic money. FIG. 13shows, in the first modification of the present embodiment, the localelectronic money to be deposited in the moneybox 1151 as the destinationof remittance according to the message shown in FIG. 12. In this case,local electronic money worth ¥1,000,000 is transferred to the terminalNLU4 b, while local electronic money worth 536 208,000 is transferred tothe terminal NLU4 a. The format of the local electronic money is thesame as in FIG. 6, but is illustrated here in a simplified form.

The local electronic money content analyzer 115 sends a paying-inmessage for the terminal NLU4 of destination to TP12 b. TP12 b sends thepaying-in message to the destination (Step 3206). GW1 then terminatesthe process (Step 3207).

The terminals NLU4 a and NLU4 b can confirm that local electronic moneyhas been paid in, by receiving a paying-in message from GW1. (Steps 4402and 4501)

In the first modification of the present embodiment, the users of theterminals NLU4 can use electronic money of various nominal values byhaving electronic money exchanged by GW1 into electronic money ofdesired nominal values. In the first modification, the establishmentoperation of a connection between a terminal NLU4 and GW1 in the presentembodiment applies and its description is omitted.

In the present embodiment, when money is sent from a terminal NLU4connected to LAN20 to a terminal NWU2 connected to WAN10, descriptionhas been given of a case where GW1 performs the remittance procedure onbehalf of the terminal NLU4. However, the present invention is notlimited to this method. GW1 may be arranged to manage the value of moneythat each user at a terminal NLU4 connected to LAN20 sends to a terminalNWU2 connected to WAN10, in addition to its vicarious procedures ofremittance.

As a second modification of the present embodiment, description will begiven of a case where an upper limit is set for the value of money thata user of a terminal NLU4 (a member of an organization) sends to anotheruser at a terminal NWU2 (a user outside the organization).

Suppose that a user at a terminal NLU4 sends a large sum of money higherthan the upper limit allotted to the user, in other words, in excess ofhis authority, to another user at a terminal NWU2 (a user outside theorganization).

GW1 receives through TP12 b local electronic money sent from theterminal NLU4 and passes it to the local electronic money contentanalyzer 115. In response to this, the local electronic money contentanalyzer 115 reads the nominal value from the Value field andinformation about the sender from the To field on the received localelectronic money (FIG. 6), and examines a limit of remittance imposed onthe sending user at the terminal NLU4 stored in the permission file1152.

FIG. 14 shows an example of the data stored in the permission file 1152.

In FIG. 14, the name of the user at the terminal NLU4, that is, a memberof the organization having LAN20 formed therein, is written in the userfield. The maximum amount that can be sent by the user at a time iswritten in the maximum remittance amount field. The address of thereceiver to which the user can send money is written in the receiveraddress field.

As a result of the remittance limit examination, if it makes a decisionthat the nominal value of the local electronic money that the user sentis larger than the upper limit, the local electronic money contentanalyzer 115 stores the money in the money box 1151 of the user. Then,the content analyzer 115 sends a repayment message through TP12 b to theuser at the terminal NLU4. If the local electronic money contentanalyzer 115 decides that the upper limit is not exceeded, GW1 performsthe remittance procedure on behalf of the NLU4 by following the samesteps as in the present embodiment described above (by procedure fromand after Step 3102 on in FIG. 8).

In a second modification, even when a member of an organization (a userat a terminal NLU4) tries to send a large sum of money in excess of hisauthorization to a user out of the organization (terminal NWU2), thisprocedure is refused by GW1.

In the second modification, it may be so arranged that even if the sumof remittance is larger than the permissible upper limit, he can stillmake a remittance if he obtains approval from another member (hissuperior officer, for example) of the organization.

FIG. 15 is a flowchart for explaining the operation when a user at aterminal NLU4 a obtains approval from a user at a terminal NLU4 b in thesecond modification.

The user at the terminal NLU4 a retrieves local electronic money that heis going to send outside the organization from a storage device, andattaches a remittance authorization request message, including a scriptand a digital signature, to the local electronic money, and sends themoney to the terminal NLU4 b to obtain approval (Step 4601).

FIG. 16 is a diagram showing an example of local electronic money with aremittance authorization request message attached thereto in the secondmodification.

In FIG. 16, reference numeral 711 denotes local electronic moneyretrieved from the storage device. The format of this electronic moneyis the same as that in FIG. 6, but is illustrated here in a simple form.Reference numeral 712 denotes a remittance authorization request message(a script and a digital signature) attached to the local electronicmoney 711.

In FIG. 16, the contents of the script are as follows.

@ message 35429:

A request for approval of remittance for settlement No. 35429

@ comment

The script “This is to request that approval be given to my making aremittance as per settlement No. 35429.” following the comment is sentas a message to the destination of remittance. The user at the receivingterminal reads this message and decides whether or not to approve therequest.

The digital signature at the end of the message was formed by encryptingthe contents from the beginning of the message to the end of scriptusing a secret key of the user at the sending terminal NLU4 a.

The user at the terminal NLU4 b reads the comment of the script attachedto the local electronic money received from the terminal NLU4 a, anddecides whether or not to grant authorization to remit this localelectronic money (Step 4701). If authorization to remit is not granted(Step 4702), the local electronic money is sent back to the terminalNLU4 a (Step 4703). In this case, even if the user at the terminal NLU4a wants to send the local electronic money to a user outside theorganization (a user at the terminal NWU2), money change to electronicmoney is refused by GW1, so that settlement is impossible. Therefore,the terminal NLU4 a has to close the process (Step 4602).

On the other hand, when the authorization to remit money is granted(Step 4702), the user at the terminal NLU4 b attaches an authorizationgrant message, consisting of a script and a digital signature, to thelocal electronic money having an authorization request message attachedthereto and received from the terminal NLU4 a, and sends the localelectronic money back to the terminal NLU4 a (Step 4704).

FIG. 17 is a diagram showing an example of local electronic money withan accompanying authorization grant message in the second modification.

In FIG. 17, reference numeral 713 denotes an authorization grantmessage. Reference numerals 711 and 712 denote local electronic moneyaccompanying authorization request message sent from the terminal NLU4a, which are identical with those in FIG. 16.

In FIG. 17, the contents of the script are as follows.

@ message accepted:

The request for approval of your message is accepted.

@ comment

The script “message accepted” following the comment is sent to theterminal NLU4 a. By reading this message, the user at the terminal NLU4a knows that he is permitted to send money.

Even when the local electronic money content analyzer 115 decides thatthe local electronic money received through TP12 b from the terminalNLU4 a is larger than the permissible maximum remittance of the user atthe terminal NLU4 a stored in the permission file 1152, if anauthorization grant message is attached to the local electronic money,GW1 performs the remittance procedure by following the same steps (fromand after Step 3102 on in FIG. 8) as in the present embodiment.

As has been described, according to the present invention, whenelectronic money is remitted from one network to another, a money changeserver is used to change electronic money current only within onenetwork into electronic money current within another network.

Therefore, when the users on a network utilize a settlement processusing electronic money, by managing the money change process, it becomespossible to manage the interchange of electronic money with the users onanother network without affecting the working environment of electroniccommerce.

What is claimed is:
 1. An electronic money management method employingan electronic money digital cash system, said method employing: localelectronic money usable on a LAN which employs a same currency as wideelectronic money usable on a WAN, said local electronic money beingusable only within an organization in which said LAN is operable; anetwork device, connected to said LAN and said WAN, for mediatingelectronic money transactions between a terminal connected to said LANand a terminal connected to said WAN, said network device carrying outthe jobs of: as a first job, receiving from said LAN said localelectronic money encrypted by an encryption key of said network devicewhose destination terminal is a terminal connected to said WAN,decrypting said local electronic money by a decryption key of saidnetwork device to confirm the amount of said local electronic money,requesting issuance of said wide electronic money in the same amount assaid local electronic money thus received to an issue server connectedto said WAN, and upon receipt of said wide electronic money encrypted bysaid encryption key of said network device from said issue server,decrypting said wide electronic money by said decryption key of saidnetwork device to confirm the amount of said wide electronic money,erasing said local electronic money thus received, and encrypting saidwide electronic money by an encryption key of said destination terminalof said local electronic money thus received to transmit said wideelectronic money thus encrypted to said destination terminal of saidlocal electronic money thus received through said WAN; and as secondjob, receiving from said WAN said wide electronic money encrypted bysaid encryption key of said network device whose destination terminal isa terminal connected to said LAN, decrypting said wide electronic moneyby said decryption key of said network device to confirm the amount ofsaid wide electronic money, encrypting said wide electronic money thusdecrypted by an encryption key of a receiving server connected to saidWAN, transmitting said wide electronic money thus encrypted to saidreceiving server, and upon receipt of acknowledge from said receivingserver as to receipt of said wide electronic money, generating saidlocal electronic money in the same amount as said wide electronic money,and encrypting said local electronic money by an encryption key of saiddestination terminal of said wide electronic money thus received totransmit said local electronic money thus encrypted to said destinationterminal of said wide electronic money thus received through said LAN.2. An electronic money managing method according to claim 1, wherein:said issue server and said receiving server is a server of a bank thathas an account of said organization in which said LAN is operable; saidissue server subtracts the same amount of money as said wide electronicmoney transmitted to said network device from said account of saidorganization; and said receiving server adds the same amount of money assaid wide electronic money received from said network device to saidaccount of said organization.
 3. An electronic money managing methodaccording to claim 1, wherein: histories as to erasing of said localelectronic money and transmission of said wide electronic money carriedout by said network device in said first job, and histories as toreception of said wide electronic money and generation of said localelectronic money carried out by said network device in said second job,are stored in said network device.
 4. An electronic money managingmethod according to claim 1, wherein: in said first job, if the amountof said local electronic money received from said LAN whose destinationterminal is the terminal connected to said WAN exceeds a predeterminedamount allocated to a member of the terminal connected to said LAN, thereceived local electronic money is sent back to the terminal connectedto said LAN which is a transmitting origin of said local electronicmoney, without making the request for issuance of said wide electronicmoney to said issue server connected to said WAN.
 5. An electronic moneymanaging method according to claim 4, wherein: in said first job, whenthe amount of said local electronic money received from the LAN whosedestination terminal is the terminal connected to said WAN exceeds apredetermined amount allocated to a member of the terminal connected tosaid LAN, and said local electronic money has a message that the memberof the terminal connected to said LAN which was the transmitting originof said local electronic money is allowed to transmit such an amountexceeding said predetermined amount allocated, making the request forissuance of said wide electronic money to said issue server connected tosaid WAN, then executing the additional first job procedures.
 6. Anelectronic money management method according to claim 1, wherein: saidnetwork device further carries out the job of: as a third job, changinga combination of units comprising said local electronic moneytransmitted from said terminal connected to said LAN in accordance withinstructions from said terminal connected to said LAN, and sending saidelectronic money thus changed back to said terminal.
 7. An electronicmoney managing device for mediating electronic money transactionsemploying an electronic money digital cash system between a terminalconnected to a LAN and a terminal connected to a WAN, said WAN on whichwide electronic money flows, and said LAN on which local electronicmoney usable only within an organization in which said LAN is operableand having a same currency as said wide electronic money flows, saidmanaging device comprising: a first means for receiving from said LANsaid local electronic money encrypted by an encryption key of saidnetwork device whose destination terminal is a terminal connected tosaid WAN, decrypting said local electronic money by a decryption key ofsaid network device to confirm the amount of said local electronicmoney, requesting issuance of said wide electronic money in the sameamount as said local electronic money thus received to an issue serverconnected to said WAN, and upon receipt of said wide electronic moneyencrypted by said encryption key of said network device from said issueserver, decrypting said wide electronic money by said decryption key ofsaid network device to confirm the amount of said wide electronic money,erasing said local electronic money thus received, and encrypting saidwide electronic money by an encryption key of said destination terminalof said local electronic money thus received to transmit said wideelectronic money thus encrypted to said destination terminal of saidlocal electronic money thus received through said WAN; and a secondmeans for receiving from said WAN said wide electronic money encryptedby said encryption key of said network device whose destination terminalis a terminal connected to said LAN, decrypting said wide electronicmoney by said decryption key of said network device to confirm theamount of said wide electronic money, encrypting said wide electronicmoney thus decrypted by an encryption key of a receiving serverconnected to said WAN, transmitting said wide electronic money thusencrypted to said receiving server, and upon receipt of acknowledge fromsaid receiving server as to receipt of said wide electronic money,generating said local electronic money in the same amount as said wideelectronic money, and encrypting said local electronic money by anencryption key of said destination terminal of said wide electronicmoney thus received to transmit said local electronic money thusencrypted to said destination terminal of said wide electronic moneythus received through said LAN.
 8. An electronic money managing deviceaccording to claim 7, wherein: said issue server and said receivingserver is a server of a bank having an account of said organization inwhich said LAN is operable; said issue server subtracts the same amountof money as said wide electronic money transmitted to said networkdevice from said account of said organization; and said receiving serveradds the same amount of money as said wide electronic money receivedfrom said network device to said account of said organization.
 9. Anelectronic money managing device according to claim 7, furthercomprising: history recording means for recording histories as toerasing of said local electronic money and transmission of said wideelectronic money carried by said first means, and histories as toreception of said wide electronic money and generation of said localelectronic money carried by said second means.
 10. An electronic moneymanagement device according to claim 7, wherein: if the amount of saidlocal electronic money received from said LAN whose destination terminalis the terminal connected to said WAN exceeds a predetermined amountallocated to a member of the terminal connected to said LAN, said firstmeans sends the received local electronic money back to the terminalconnected to said LAN which was a transmitting origin of said localelectronic money without making the request for issuance of said wideelectronic money to said issue server connected to said WAN.
 11. Anelectronic money managing device according to claim 10, wherein: whenthe amount of said local electronic money received from the LAN whosedestination terminal is the terminal connected to said WAN exceeds apredetermined amount allocated to a member of the terminal connected tosaid LAN, if said local electronic money has a message that the memberof the terminal connected to said LAN and being the transmitting originof said local electronic money is allowed to transmit such an amountexceeding said predetermined amount allocated, said first means makesthe request for issuance of said wide electronic money to said issueserver connected to said WAN, then executes the additional first meansprocedures.
 12. An electronic money managing device according to claim7, further comprising: changing means for changing a combination ofunits comprising said local electronic money transmitted from saidterminal connected to said LAN in accordance with instructions from saidterminal connected to said LAN, and sending said electronic money thuschanged back to said terminal.
 13. An information recording mediumstoring therein an electronic money managing program for mediatingelectronic money transactions employing an electronic money digital cashsystem between a terminal connected to a LAN and a terminal connected toa WAN, said WAN on which wide electronic money flows, and said LAN onwhich local electronic money usable only within an organization in whichsaid LAN is operable and having the same currency as said wideelectronic money flows, said electronic money managing programimplementing the following means in an information processing deviceconnected to said LAN and said WAN: a first means for receiving fromsaid LAN said local electronic money encrypted by an encryption key ofsaid network device whose destination terminal is a terminal connectedto said WAN, decrypting said local electronic money by a decryption keyof said network device to confirm the amount of said local electronicmoney, requesting issuance of said wide electronic money in the sameamount as said local electronic money thus received to an issue serverconnected to said WAN, and upon receipt of said wide electronic moneyencrypted by said encryption key of said network device from said issueserver, decrypting said wide electronic money by said decryption key ofsaid network device to confirm the amount of said wide electronic money,erasing said local electronic money thus received, and encrypting saidwide electronic money by an encryption key of said destination terminalof said local electronic money thus received to transmit said wideelectronic money thus encrypted to said destination terminal of saidlocal electronic money thus received through said WAN; and a secondmeans for receiving from said WAN said wide electronic money encryptedby said encryption key of said network device whose destination terminalis a terminal connected to said LAN, decrypting said wide electronicmoney by said decryption key of said network device to confirm theamount of said wide electronic money, encrypting said wide electronicmoney thus decrypted by an encryption key of a receiving serverconnected to said WAN, transmitting said wide electronic money thusencrypted to said receiving server, and upon receipt of acknowledge fromsaid receiving server as to receipt of said wide electronic money,generating said local electronic money in the same amount as said wideelectronic money, and encrypting said local electronic money by anencryption key of said destination terminal of said wide electronicmoney thus received to transmit said local electronic money thusencrypted to said destination terminal of said wide electronic moneythus received through said LAN.